Standalone Firewall

TomEastep

Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version
1.2 or any later version published by the Free Software Foundation; with
no Invariant Sections, with no Front-Cover, and with no Back-Cover
Texts. A copy of the license is included in the section entitled
“GNU Free Documentation
License”.

Caution

This article applies to Shorewall 4.4 and
later. If you are running a version of Shorewall earlier than Shorewall
4.4.0 then please see the documentation for that
release.

Introduction

Setting up Shorewall on a standalone Linux system is very easy if
you understand the basics and follow the documentation.

This guide doesn't attempt to acquaint you with all of the features
of Shorewall. It rather focuses on what is required to configure Shorewall
in one of its most common configurations:

Linux system

Single external IP address

Connection through Cable Modem, DSL,
ISDN, Frame Relay, dial-up... or connected to a
LAN and you simply wish to protect your Linux
system from other systems on that LAN.

System Requirements

Shorewall requires that you have the
iproute/iproute2 package installed
(on RedHat™, the package is called
iproute). You can tell if this package is installed
by the presence of an ip program on your firewall
system. As root, you can use the which command to
check for this program:

[root@gateway root]# which ip
/sbin/ip
[root@gateway root]#

Before you start

I recommend that you read through the guide first to familiarize
yourself with what's involved then go back through it again making your
configuration changes.

Caution

If you edit your configuration files on a
Windows™ system, you must save them as
Unix™ files if your editor supports that option
or you must run them through dos2unix before trying
to use them. Similarly, if you copy a configuration file from your
Windows™ hard drive to a floppy disk, you must
run dos2unix against the copy before using it with
Shorewall.

Conventions

Points at which configuration changes are recommended are flagged
with .

Configuration notes that are unique to Debian and it's derivatives
are marked with .

PPTP/ADSL

If you have an ADSL Modem and you use
PPTP to communicate with a server in that modem, you
must make the changes recommended here in addition to those detailed below.
ADSL with PPTP is most commonly
found in Europe, notably in Austria.

Shorewall Concepts

The configuration files for Shorewall are contained in the directory
/etc/shorewall -- for simple
setups, you only need to deal with a few of these as described in this
guide. After you have installed
Shorewall, you can find the Samples as follows:

If you installed using an RPM, the samples
will be in the Samples/one-interface subdirectory of the
Shorewall documentation directory. If you don't know where the
Shorewall documentation directory is, you can find the samples using
this command:

If you installed using the tarball, the samples are in the
Samples/one-interface directory
in the tarball.

If
you installed using a Shorewall 4.x .deb, the samples are in /usr/share/doc/shorewall/examples/one-interface..
You do not need the shorewall-doc package to have access to the
samples.

Warning

Note to Debian Users

You will find that your /etc/shorewall directory is empty. This is
intentional. If you need configuration files other than those found in
/usr/share/doc/shorewall/examples/one-interface,
they may be found on your system in the directory /usr/share/doc/shorewall/default-config.
Simply copy the files you need from that directory to /etc/shorewall and modify the
copies.

As each file is introduced, I suggest that you look at the actual
file on your system and that you look at the man page for that
file. For example, to look at the man page for the
/etc/shorewall/zones file, type man
shorewall-zones at a shell prompt.

Note: Beginning with Shorewall 4.4.20.1, there are versions of the
sample files that are annotated with the corresponding manpage contents.
These files have names ending in '.annotated'. You might choose to look at
those files instead.

Shorewall views the network where it is running as being composed of
a set of zones. In the one-interface sample
configuration, only two zones are defined:

Note that Shorewall recognizes the firewall system as its own zone.
When the /etc/shorewall/zones file is processed, the
name of the firewall zone (“fw” in the above example) is
stored in the shell variable $FW which may be used
to refer to the firewall zone throughout the Shorewall
configuration.

Rules about what traffic to allow and what traffic to deny are
expressed in terms of zones.

You express your default policy for connections from one zone to
another zone in the /etc/shorewall/policy
file.

For each connection request entering the firewall, the request is
first checked against the
/etc/shorewall/rules file. If no
rule in that file matches the connection request then the first policy in
/etc/shorewall/policy that matches the request is
applied. If there is a common
action defined for the policy in
/etc/shorewall/actions or
/usr/share/shorewall/actions.std then that action is
performed before the policy is applied. The purpose of the common action
is two-fold:

It silently drops or rejects harmless common traffic that would
otherwise clutter up your log — Broadcasts for example.

If ensures that traffic critical to correct operation is allowed
through the firewall — ICMP fragmentation-needed
for example.

The /etc/shorewall/policy file included with
the one-interface sample has the following policies:

drop (ignore) all connection requests from the Internet to your
firewall

reject all other connection requests (Shorewall requires this
catchall policy).

The word info in the LOG LEVEL column for the
last two policies indicates that packets dropped or rejected under those
policies should be logged at that
level.

At this point, edit your /etc/shorewall/policy
and make any changes that you wish.

External Interface

The firewall has a single network interface. Where Internet
connectivity is through a cable or DSL“Modem”, the External Interface will be
the Ethernet adapter (eth0) that
is connected to that “Modem”unless you connect via
Point-to-Point Protocol over Ethernet
(PPPoE) or Point-to-Point Tunneling
Protocol (PPTP) in which case the External
Interface will be a PPP interface (e.g., ppp0). If you connect via a regular modem,
your External Interface will also be ppp0. If you connect using
ISDN, your external interface will be ippp0.

Caution

Be sure you know which interface is your external interface. Many
hours have been spent floundering by users who have configured the wrong
interface. If you are unsure, then as root type ip route
ls at the command line. The device listed in the last
(default) route should be your external interface.

The Shorewall one-interface sample configuration assumes that the
external interface is eth0. If
your configuration is different, you will have to modify the sample
/etc/shorewall/interfaces file accordingly. While you
are there, you may wish to review the list of options that are specified
for the interface. Some hints:

Tip

If your external interface is ppp0 or ippp0 or if you have a static IP address,
you can remove “dhcp” from the option list.

IP Addresses

Before going further, we should say a few words about
Internet Protocol (IP) addresses.
Normally, your Internet Service Provider
(ISP) will assign you a single IP
address. That address can be assigned statically, by the Dynamic
Host Configuration Protocol (DHCP), through
the establishment of your dial-up connection, or during establishment of
your other type of PPP (PPPoA,
PPPoE, etc.) connection.

RFC-1918 reserves several
PrivateIP address ranges for use
in private networks:

These addresses are sometimes referred to as
non-routable because the Internet backbone routers
will not forward a packet whose destination address is reserved by
RFC-1918. In some cases though,
ISPs are assigning these addresses then using
Network Address Translation-
NAT) to rewrite packet headers when
forwarding to/from the Internet.

It is important that these commands work properly because when you
encounter connection problems when Shorewall is running, the first thing
that you should do is to look at the Netfilter log; with the help of
Shorewall FAQ 17, you can usually
resolve the problem quickly.

The Netfilter log location is distribution-dependent:

Debian and its derivatives log Netfilter messages to
/var/log/kern.log.

For other distributions, Netfilter messages are most commonly
logged to /var/log/messages.

If you are running a distribution that logs Netfilter messages to a
log other than /var/log/messages, then modify the
LOGFILE setting in /etc/shorewall/shorewall.conf to
specify the name of your log.

Important

The LOGFILE setting does not control where the Netfilter log is
maintained -- it simply tells the /sbin/shorewall
utility where to find the log.

Kernel Module Loading

Beginning in Shorewall 4.4.7,
/etc/shorewall/shorewall.conf contains a
LOAD_HELPERS_ONLY option which is set to Yes in the
samples. This causes Shorewall to attempt to load the modules listed in
/usr/share/shorewall/helpers. In addition, it sets
sip_direct_media=0 when loading the
nf_conntrack_sip module. That setting is somewhat less secure than
sip_direct_media=1, but it generally
makes VOIP through the firewall work much better.

The modules in /usr/share/shorewall/helpers are
those that are not autoloaded. If your kernel does not support module
autoloading and you want Shorewall to attempt to load all netfilter
modules that it might require, then set LOAD_HELPERS_ONLY=No. That will
cause Shorewall to try to load the modules listed in
/usr/share/shorewall/modules. That file does not set
sip_direct_media=0.

If you need to modify either
/usr/share/shorewall/helpers or
/usr/share/shorewall/modules then copy the file to
/etc/shorewall and modify the copy.

Modify the setting of LOAD_HELPER_ONLY as necessary.

Enabling other Connections

Shorewall includes a collection of macros that can be used to
quickly allow or deny services. You can find a list of the macros included
in your version of Shorewall using the command ls
/usr/share/shorewall/macro.*.

If you wish to enable connections from the Internet to your firewall
and you find an appropriate macro in
/usr/share/shorewall/macro.*, the general format of a
rule in /etc/shorewall/rules is:

#ACTION SOURCE DEST PROTO DPORT
<macro>(ACCEPT) net $FW

Important

Be sure to add your rules after the line that reads ?SECTION NEW.

Example 1. You want to run a Web Server and a IMAP Server on your firewall
system:

Caution

The Shorewall-provided macros assume that the associated service
is using it's standard port and will not work with services listening on
a non-standard port.

You may also choose to code your rules directly without using the
pre-defined macros. This will be necessary in the event that there is not
a pre-defined macro that meets your requirements. In that case the general
format of a rule in /etc/shorewall/rules is:

#ACTION SOURCE DEST PROTO DPORT
ACCEPT net $FW <protocol><port>

Example 2. You want to run a Web Server and a IMAP Server on your firewall
system:

If you don't know what port and protocol a particular application
uses, see here.

Important

I don't recommend enabling telnet to/from the Internet because it
uses clear text (even for login!). If you want shell access to your
firewall from the Internet, use SSH:

#ACTION SOURCE DESTINATION PROTO DPORT
SSH(ACCEPT) net $FW

At this point, edit /etc/shorewall/rules to add
other connections as desired.

Starting and Stopping Your Firewall

The installation procedure
configures your system to start Shorewall at system boot but startup is
disabled so that your system won't try to start Shorewall before
configuration is complete. Once you have completed configuration of your
firewall, you must edit /etc/shorewall/shorewall.conf and set
STARTUP_ENABLED=Yes.

Important

Users of the .deb package must edit
/etc/default/shorewall and set
startup=1.

Important

You must enable startup by editing
/etc/shorewall/shorewall.conf and setting
STARTUP_ENABLED=Yes.

While you are editing shorewall.conf, it is a
good idea to check the value of the SUBSYSLOCK option. You can find a
description of this option by typing 'man shorewall.conf' at a shell
prompt and searching for SUBSYSLOCK.

The firewall is started using the “shorewall
start” command and stopped using
“shorewall stop”. When the firewall is
stopped, traffic is enabled on those hosts that have an entry in
/etc/shorewall/stoppedrules
(/etc/shorewall/routestopped
in Shorewall 4.5.7 and earlier). A running firewall may be restarted using
the “shorewall reload” command. If you
want to totally remove any trace of Shorewall from your Netfilter
configuration, use “shorewall
clear”.

Warning

If you are connected to your firewall from the Internet, do not
issue a “shorewall stop” command unless
you have either:

The firewall will start after your network interface has been
brought up. This leaves a small window between the time that the network
interface is working and when the firewall is controlling connections
through that interface. If this is a concern, you can close that window by
installing the Shorewall Init
Package.